You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/aks/control-kubeconfig-access.md
+42-50Lines changed: 42 additions & 50 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,50 +3,50 @@ title: Limit access to kubeconfig in Azure Kubernetes Service (AKS)
3
3
description: Learn how to control access to the Kubernetes configuration file (kubeconfig) for cluster administrators and cluster users
4
4
ms.topic: article
5
5
ms.custom: devx-track-azurecli
6
-
ms.date: 05/06/2020
6
+
ms.date: 03/28/2023
7
7
---
8
8
9
9
# Use Azure role-based access control to define access to the Kubernetes configuration file in Azure Kubernetes Service (AKS)
10
10
11
-
You can interact with Kubernetes clusters using the `kubectl` tool. The Azure CLI provides an easy way to get the access credentials and configuration information to connect to your AKS clusters using `kubectl`. To limit who can get that Kubernetes configuration (*kubeconfig*) information and to limit the permissions they then have, you can use Azure role-based access control (Azure RBAC).
11
+
You can interact with Kubernetes clusters using the `kubectl` tool. The Azure CLI provides an easy way to get the access credentials and *kubeconfig*configuration file to connect to your AKS clusters using `kubectl`. You can use Azure role-based access control (Azure RBAC) to limit who can get access to the *kubeconfig* file and the permissions they have.
12
12
13
13
This article shows you how to assign Azure roles that limit who can get the configuration information for an AKS cluster.
14
14
15
15
## Before you begin
16
16
17
-
This article assumes that you have an existing AKS cluster. If you need an AKS cluster, see the AKS quickstart [using the Azure CLI][aks-quickstart-cli], [using Azure PowerShell][aks-quickstart-powershell], or [using the Azure portal][aks-quickstart-portal].
17
+
* This article assumes that you have an existing AKS cluster. If you need an AKS cluster, create one using [Azure CLI][aks-quickstart-cli], [Azure PowerShell][aks-quickstart-powershell], or [the Azure portal][aks-quickstart-portal].
18
+
* This article also requires that you're running Azure CLI version 2.0.65 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][azure-cli-install].
18
19
19
-
This article also requires that you are running the Azure CLI version 2.0.65 or later. Run `az --version` to find the version. If you need to install or upgrade, see [Install Azure CLI][azure-cli-install].
20
+
## Available permissions for cluster roles
20
21
21
-
## Available cluster roles permissions
22
+
When you interact with an AKS cluster using the `kubectl` tool, a configuration file, called *kubeconfig*, defines cluster connection information. This configuration file is typically stored in *~/.kube/config*. Multiple clusters can be defined in this *kubeconfig* file. You can switch between clusters using the [`kubectl config use-context`][kubectl-config-use-context] command.
22
23
23
-
When you interact with an AKS cluster using the `kubectl` tool, a configuration file is used that defines cluster connection information. This configuration file is typically stored in *~/.kube/config*. Multiple clusters can be defined in this *kubeconfig* file. You switch between clusters using the [kubectl config use-context][kubectl-config-use-context] command.
24
+
The [`az aks get-credentials`][az-aks-get-credentials] command lets you get the access credentials for an AKS cluster and merges these credentials into the *kubeconfig*file. You can use Azure RBAC to control access to these credentials. These Azure roles let you define who can retrieve the *kubeconfig* file and what permissions they have within the cluster.
24
25
25
-
The [az aks get-credentials][az-aks-get-credentials] command lets you get the access credentials for an AKS cluster and merges them into the *kubeconfig* file. You can use Azure role-based access control (Azure RBAC) to control access to these credentials. These Azure roles let you define who can retrieve the *kubeconfig* file, and what permissions they then have within the cluster.
26
+
There are two Azure roles you can apply to an Azure Active Directory (Azure AD) user or group:
26
27
27
-
The two built-in roles are:
28
+
-**Azure Kubernetes Service Cluster Admin Role**
28
29
29
-
***Azure Kubernetes Service Cluster Admin Role**
30
-
* Allows access to *Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action* API call. This API call [lists the cluster admin credentials][api-cluster-admin].
31
-
* Downloads *kubeconfig* for the *clusterAdmin* role.
32
-
***Azure Kubernetes Service Cluster User Role**
33
-
* Allows access to *Microsoft.ContainerService/managedClusters/listClusterUserCredential/action* API call. This API call [lists the cluster user credentials][api-cluster-user].
34
-
* Downloads *kubeconfig* for *clusterUser* role.
30
+
* Allows access to `Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action` API call. This API call [lists the cluster admin credentials][api-cluster-admin].
31
+
* Downloads *kubeconfig* for the *clusterAdmin* role.
35
32
36
-
These Azure roles can be applied to an Azure Active Directory (AD) user or group.
33
+
-**Azure Kubernetes Service Cluster User Role**
34
+
35
+
* Allows access to `Microsoft.ContainerService/managedClusters/listClusterUserCredential/action` API call. This API call [lists the cluster user credentials][api-cluster-user].
36
+
* Downloads *kubeconfig* for *clusterUser* role.
37
37
38
38
> [!NOTE]
39
-
> On clusters that use Azure AD, users with the *clusterUser* role have an empty *kubeconfig* file that prompts a log in. Once logged in, users have access based on their Azure AD user or group settings. Users with the *clusterAdmin* role have admin access.
39
+
> On clusters that use Azure AD, users with the *clusterUser* role have an empty *kubeconfig* file that prompts a login. Once logged in, users have access based on their Azure AD user or group settings. Users with the *clusterAdmin* role have admin access.
40
40
>
41
-
> On clusters that do not use Azure AD, the *clusterUser* role has same effect of *clusterAdmin* role.
41
+
> On clusters that don't use Azure AD, the *clusterUser* role has same effect of *clusterAdmin* role.
42
42
43
43
## Assign role permissions to a user or group
44
44
45
-
To assign one of the available roles, you need to get the resource ID of the AKS cluster and the ID of the Azure AD user account or group. The following example commands:
45
+
To assign one of the available roles, you need to get the resource ID of the AKS cluster and the ID of the Azure AD user account or group using the following steps:
46
46
47
-
* Get the cluster resource ID using the [az aks show][az-aks-show] command for the cluster named *myAKSCluster* in the *myResourceGroup* resource group. Provide your own cluster and resource group name as needed.
48
-
* Use the [az account show][az-account-show] and [az ad user show][az-ad-user-show] commands to get your user ID.
49
-
* Finally, assign a role using the [az role assignment create][az-role-assignment-create] command.
47
+
1. Get the cluster resource ID using the [`az aks show`][az-aks-show] command for the cluster named *myAKSCluster* in the *myResourceGroup* resource group. Provide your own cluster and resource group name as needed.
48
+
2. Use the [`az account show`][az-account-show] and [`az ad user show`][az-ad-user-show] commands to get your user ID.
49
+
3. Assign a role using the [`az role assignment create`][az-role-assignment-create] command.
50
50
51
51
The following example assigns the *Azure Kubernetes Service Cluster Admin Role* to an individual user account:
52
52
@@ -65,55 +65,48 @@ az role assignment create \
65
65
--role "Azure Kubernetes Service Cluster Admin Role"
66
66
```
67
67
68
+
If you want to assign permissions to an Azure AD group, update the `--assignee` parameter shown in the previous example with the object ID for the *group* rather than the *user*.
69
+
70
+
To get the object ID for a group, use the [`az ad group show`][az-ad-group-show] command. The following command gets the object ID for the Azure AD group named *appdev*:
71
+
72
+
```azurecli-interactive
73
+
az ad group show --group appdev --query objectId -o tsv
74
+
```
75
+
68
76
> [!IMPORTANT]
69
-
> In some cases, the *user.name* in the account is different than the *userPrincipalName*, such as with Azure AD guest users:
77
+
> In some cases, such as Azure AD guest users, the *user.name* in the account is different than the *userPrincipalName*.
> $ az ad user list --query "[?contains(otherMails,'[email protected]')].{UPN:userPrincipalName}" -o tsv
75
84
> user_contoso.com#EXT#@contoso.onmicrosoft.com
76
85
> ```
77
86
>
78
-
> In this case, set the value of *ACCOUNT_UPN* to the *userPrincipalName* from the Azure AD user. For example, if your account *user.name* is *user\@contoso.com*:
79
-
>
87
+
> In this case, set the value of *ACCOUNT_UPN* to the *userPrincipalName* from the Azure AD user. For example, if your account *user.name* is *user\@contoso.com*, this action would look like the following example:
88
+
>
80
89
> ```azurecli-interactive
81
90
> ACCOUNT_UPN=$(az ad user list --query "[?contains(otherMails,'[email protected]')].{UPN:userPrincipalName}" -o tsv)
82
91
> ```
83
92
84
-
> [!TIP]
85
-
> If you want to assign permissions to an Azure AD group, update the `--assignee` parameter shown in the previous example with the object ID for the *group* rather than a *user*. To obtain the object ID for a group, use the [az ad group show][az-ad-group-show] command. The following example gets the object ID for the Azure AD group named *appdev*: `az ad group show --group appdev --query objectId -o tsv`
86
-
87
-
You can change the previous assignment to the *Cluster User Role* as needed.
88
-
89
-
The following example output shows the role assignment has been successfully created:
With Azure roles assigned, use the [az aks get-credentials][az-aks-get-credentials] command to get the *kubeconfig* definition for your AKS cluster. The following example gets the *--admin* credentials, which work correctly if the user has been granted the *Cluster Admin Role*:
95
+
Once the roles are assigned, use the [`az aks get-credentials`][az-aks-get-credentials] command to get the *kubeconfig* definition for your AKS cluster. The following example gets the *--admin* credentials, which works correctly if the user has been granted the *Cluster Admin Role*:
107
96
108
97
```azurecli-interactive
109
98
az aks get-credentials --resource-group myResourceGroup --name myAKSCluster --admin
110
99
```
111
100
112
-
You can then use the [kubectl config view][kubectl-config-view] command to verify that the *context* for the cluster shows that the admin configuration information has been applied:
101
+
You can then use the [`kubectl config view`][kubectl-config-view] command to verify that the *context* for the cluster shows that the admin configuration information has been applied.
113
102
114
-
```
103
+
```azurecli-interactive
115
104
$ kubectl config view
105
+
```
116
106
107
+
Your output should look similar to the following example output:
108
+
109
+
```azurecli-interactive
117
110
apiVersion: v1
118
111
clusters:
119
112
- cluster:
@@ -138,7 +131,7 @@ users:
138
131
139
132
## Remove role permissions
140
133
141
-
To remove role assignments, use the [az role assignment delete][az-role-assignment-delete] command. Specify the account ID and cluster resource ID, as obtained in the previous commands. If you assigned the role to a group rather than a user, specify the appropriate group object ID rather than account object ID for the `--assignee` parameter:
134
+
To remove role assignments, use the [`az role assignment delete`][az-role-assignment-delete] command. Specify the account ID and cluster resource ID that you obtained in the previous steps. If you assigned the role to a group rather than a user, specify the appropriate group object ID rather than account object ID for the `--assignee` parameter.
142
135
143
136
```azurecli-interactive
144
137
az role assignment delete --assignee $ACCOUNT_ID --scope $AKS_CLUSTER
@@ -158,7 +151,6 @@ For enhanced security on access to AKS clusters, [integrate Azure Active Directo
0 commit comments